Skip to content

Commit f70d855

Browse files
claudeclaude
committed
bughunt yarn-classic probe: dev flow after scan
1 parent 61cfb9b commit f70d855

1 file changed

Lines changed: 219 additions & 0 deletions

File tree

‎.github/workflows/bughunt-yarn-classic.yml‎

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
name: bughunt yarn-classic probe
2+
on:
3+
push:
4+
branches: ['bughunt/yarn-classic/**']
5+
permissions:
6+
contents: read
7+
jobs:
8+
probe:
9+
name: probe ${{ matrix.os }} yarn ${{ matrix.yarn }}
10+
runs-on: ${{ matrix.os }}
11+
timeout-minutes: 45
12+
strategy:
13+
fail-fast: false
14+
matrix:
15+
os: [ubuntu-latest, macos-latest, windows-latest]
16+
yarn: ['1.7.0', '1.10.1', '1.22.22']
17+
defaults:
18+
run:
19+
shell: bash
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
persist-credentials: false
25+
- name: Install Rust
26+
run: rustup show
27+
- name: Setup Node.js
28+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
29+
with:
30+
node-version: '24.x'
31+
- name: Build socket-patch
32+
run: cargo build -p socket-patch-cli
33+
- name: Probe
34+
env:
35+
COREPACK_ENABLE_DOWNLOAD_PROMPT: '0'
36+
YARN_V: ${{ matrix.yarn }}
37+
run: |
38+
cat > "$RUNNER_TEMP/probe.sh" <<'PROBE_EOF'
39+
#!/usr/bin/env bash
40+
# probe.sh SP_BIN YARN_VERSION -- prints RESULT lines
41+
set -u
42+
SP=$1; V=$2; W="$(pwd)/probe work ü"; rm -rf "$W"; mkdir -p "$W"; cd "$W"
43+
export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
44+
PY=python3; python3 -c 1 2>/dev/null || PY=python
45+
PORT=18999; API=http://127.0.0.1:$PORT
46+
winpath() { if command -v cygpath >/dev/null; then cygpath -m "$1"; else echo "$1"; fi; }
47+
Y() { corepack yarn@$V "$@"; }
48+
sp() { "$SP" "$@" --api-url $API --org test-org --api-token fake; }
49+
result() { echo "RESULT os=${RUNNER_OS:-local} yarn=$V $*"; }
50+
markers() { (cd "$1" && find . -path '*node_modules/*' -maxdepth 5 -name index.js | sort | while read -r f; do case "$f" in *left-pad*|*is-number*|*string-locale*) if head -c 22 "$f" | grep -q SOCKET-PATCHED; then printf '%s=P,' "$(dirname "$f" | sed 's#.*node_modules/##')"; else printf '%s=UNPATCHED,' "$(dirname "$f" | sed 's#.*node_modules/##')"; fi;; esac; done); }
51+
fresh() { rm -rf "$2"; mkdir -p "$2"; (cd "$1" && tar cf - --exclude=node_modules --exclude=.c . ) | (cd "$2" && tar xf -); }
52+
mkdir pk && (cd pk && for s in left-pad@1.3.0 left-pad@1.2.0 is-number@7.0.0 @isaacs/string-locale-compare@1.1.0; do npm pack $s --silent >/dev/null; done; ls)
53+
cat > pkbuild.py <<'PY'
54+
# pkbuild.py OUTCFG UUID UPSTREAM_TGZ [UUID TGZ ...] -> patched tarballs + cfg.json (prepends marker to index.js)
55+
import io, json, os, sys, tarfile
56+
out = sys.argv[1]; args = sys.argv[2:]; cfg = []
57+
for i in range(0, len(args), 2):
58+
uuid, up = args[i], os.path.abspath(args[i+1])
59+
d = os.path.dirname(up); src = tarfile.open(up); pj = None
60+
dst_path = up[:-4] + ".patched.tgz"; dst = tarfile.open(dst_path, "w:gz")
61+
for m in src.getmembers():
62+
if not m.isfile(): continue
63+
data = src.extractfile(m).read(); rel = m.name.split('/', 1)[1]
64+
if rel == "package.json": pj = json.loads(data)
65+
if rel == "index.js":
66+
open(up + ".orig", "wb").write(data); data = b"/* SOCKET-PATCHED */\n" + data; open(up + ".new", "wb").write(data)
67+
t = tarfile.TarInfo("package/" + rel); t.size = len(data); t.mode = 0o644; t.mtime = 0
68+
dst.addfile(t, io.BytesIO(data))
69+
dst.close()
70+
cfg.append({"name": pj["name"], "version": pj["version"], "uuid": uuid, "tgz": dst_path,
71+
"files": {"package/index.js": [up + ".orig", up + ".new"]}})
72+
json.dump(cfg, open(out, "w"), indent=1)
73+
74+
PY
75+
cat > mock.py <<'PY'
76+
#!/usr/bin/env python3
77+
"""Mock socket patch API. Config: JSON list of pkgs
78+
{name, version, uuid, tgz (patched tarball path), files: {"package/index.js": [orig_path, patched_path]}}
79+
Usage: mock.py CONFIG PORT
80+
"""
81+
import base64, hashlib, json, re, sys, urllib.parse
82+
from http.server import ThreadingHTTPServer, BaseHTTPRequestHandler
83+
84+
CFG = json.load(open(sys.argv[1]))
85+
PORT = int(sys.argv[2])
86+
ORG = "test-org"
87+
TOKEN = "33333333-3333-4333-8333-333333333333"
88+
BASE = f"http://127.0.0.1:{PORT}"
89+
LOG = open(sys.argv[1] + ".log", "a")
90+
91+
def gsha(b):
92+
return hashlib.sha256(b"blob %d\0" % len(b) + b).hexdigest()
93+
94+
def purl(p):
95+
return f"pkg:npm/{p['name']}@{p['version']}"
96+
97+
def base(p):
98+
return p['name'].split('/')[-1]
99+
100+
def hosted(p):
101+
return f"{BASE}/patch/npm/{p['name']}/{p['version']}/{TOKEN}/{p['uuid']}/{base(p)}-{p['version']}.tgz"
102+
103+
def tgz(p):
104+
return open(p['tgz'], 'rb').read()
105+
106+
def summary(p):
107+
return {"uuid": p['uuid'], "purl": purl(p), "tier": "free", "cveIds": ["CVE-2026-1111"],
108+
"ghsaIds": ["GHSA-aaaa-bbbb-cccc"], "severity": "high", "title": "fixture",
109+
"publishedAt": "2026-01-01T00:00:00Z", "description": "x", "license": "MIT",
110+
"vulnerabilities": {}}
111+
112+
def view(p):
113+
files = {}
114+
for k, (o, n) in p['files'].items():
115+
ob, nb = open(o, 'rb').read(), open(n, 'rb').read()
116+
files[k] = {"beforeHash": gsha(ob), "afterHash": gsha(nb),
117+
"blobContent": base64.b64encode(nb).decode()}
118+
return {"uuid": p['uuid'], "purl": purl(p), "publishedAt": "2026-01-01T00:00:00Z",
119+
"files": files,
120+
"vulnerabilities": {"GHSA-aaaa-bbbb-cccc": {"cves": ["CVE-2026-1111"], "summary": "s",
121+
"severity": "high", "description": "d"}},
122+
"description": "x", "license": "MIT", "tier": "free"}
123+
124+
class H(BaseHTTPRequestHandler):
125+
def log_message(self, *a):
126+
LOG.write("%s %s\n" % (self.command, self.path)); LOG.flush()
127+
128+
def send(self, code, body, ctype="application/json"):
129+
if not isinstance(body, bytes):
130+
body = json.dumps(body).encode()
131+
self.send_response(code)
132+
self.send_header("Content-Type", ctype)
133+
self.send_header("Content-Length", str(len(body)))
134+
self.end_headers()
135+
self.wfile.write(body)
136+
137+
def body(self):
138+
n = int(self.headers.get('Content-Length') or 0)
139+
return json.loads(self.rfile.read(n) or b"{}")
140+
141+
def do_POST(self):
142+
path = urllib.parse.unquote(self.path.split('?')[0])
143+
b = self.body()
144+
if path == f"/v0/orgs/{ORG}/patches/batch":
145+
want = set(b.get("components") and [c.get("purl") for c in b["components"]] or [])
146+
pk = [{"purl": purl(p), "patches": [summary(p)]} for p in CFG if not want or purl(p) in want]
147+
return self.send(200, {"packages": pk, "canAccessPaidPatches": False})
148+
if path == f"/v0/orgs/{ORG}/patches/package":
149+
res = {}
150+
for p in CFG:
151+
h = hosted(p); t = tgz(p)
152+
res[p['uuid']] = {"status": "granted", "url": h, "purl": purl(p),
153+
"artifacts": [{"kind": "tarball", "url": h, "integrity": {
154+
"sha512": "sha512-" + base64.b64encode(hashlib.sha512(t).digest()).decode(),
155+
"sha1": hashlib.sha1(t).hexdigest()}}],
156+
"registryOverride": None}
157+
return self.send(200, {"results": res})
158+
self.send(404, {"error": "nf"})
159+
160+
def do_GET(self):
161+
path = urllib.parse.unquote(self.path.split('?')[0])
162+
m = re.match(rf"^/v0/orgs/{ORG}/patches/by-package/(.+)$", path)
163+
if m:
164+
q = m.group(1)
165+
ps = [summary(p) for p in CFG if purl(p) == q or q.startswith(purl(p))]
166+
return self.send(200, {"patches": ps, "canAccessPaidPatches": False})
167+
m = re.match(rf"^/v0/orgs/{ORG}/patches/view/(.+)$", path)
168+
if m:
169+
for p in CFG:
170+
if p['uuid'] == m.group(1):
171+
return self.send(200, view(p))
172+
for p in CFG:
173+
if path == urllib.parse.unquote(hosted(p)[len(BASE):]):
174+
return self.send(200, tgz(p), "application/octet-stream")
175+
self.send(404, {"error": "nf"})
176+
177+
ThreadingHTTPServer(("127.0.0.1", PORT), H).serve_forever()
178+
179+
PY
180+
$PY pkbuild.py cfg.json 7c8d9e0f-1a2b-4c3d-8e4f-5a6b7c8d9e01 pk/left-pad-1.3.0.tgz 7c8d9e0f-1a2b-4c3d-8e4f-5a6b7c8d9e02 pk/left-pad-1.2.0.tgz 7c8d9e0f-1a2b-4c3d-8e4f-5a6b7c8d9e03 pk/is-number-7.0.0.tgz 7c8d9e0f-1a2b-4c3d-8e4f-5a6b7c8d9e04 pk/isaacs-string-locale-compare-1.1.0.tgz
181+
$PY mock.py cfg.json $PORT > mock.out 2>&1 &
182+
MOCKPID=$!; sleep 3; curl -s -o /dev/null -w "mock %{http_code}\n" $API/v0/orgs/test-org/patches/view/7c8d9e0f-1a2b-4c3d-8e4f-5a6b7c8d9e01
183+
scan() { # scan DIR MODE TAG
184+
sp scan --mode $2 --json --yes --cwd "$(winpath "$1")" > "$W/$3.scan.json" 2>"$W/$3.scan.err"; local rc=$?
185+
result "case=$3-scan rc=$rc $($PY -c "import json,sys;e=json.load(open(sys.argv[1]));print('status='+str(e.get('status')),'redir='+str(e.get('redirect',{}).get('redirected')),'warn='+','.join(w.get('code','') for w in e.get('warnings',[])+e.get('redirect',{}).get('warnings',[])),'err='+str((e.get('error') or {}).get('code')))" "$W/$3.scan.json" 2>&1 | tail -1)"
186+
}
187+
check() { # check DIR TAG [flags]
188+
fresh "$1" "$W/$2.f"; (cd "$W/$2.f" && YARN_CACHE_FOLDER="$W/c.$2.$RANDOM" Y install --frozen-lockfile ${3:-} --no-progress > "$W/$2.f.log" 2>&1); local rc=$?
189+
result "case=$2-fresh-frozen${3:-} rc=$rc $(markers "$W/$2.f") err=$(grep -m1 -i '^error' "$W/$2.f.log" | cut -c1-90 | tr ' ' _)"
190+
}
191+
# --- case D: dev flow after scan: yarn add / pure-lockfile reinstall, then frozen fresh + vex / vendor --check ---
192+
for m in hosted vendored; do
193+
P="$W/dev-$m"; mkdir -p "$P"
194+
echo '{"name":"root","version":"1.0.0","private":true,"dependencies":{"left-pad":"1.3.0","is-number":"7.0.0"}}' > "$P/package.json"
195+
(cd "$P" && YARN_CACHE_FOLDER="$P/.c" Y install --no-progress >/dev/null 2>&1) || result "case=dev-$m fixture-install-failed"
196+
scan "$P" $m dev-$m; check "$P" dev-$m
197+
grep -E '^ resolved' "$P/yarn.lock" | sed 's/^/ LOCK0 /' | cut -c1-140
198+
cp "$P/yarn.lock" "$W/dev-$m.scanned"
199+
(cd "$P" && YARN_CACHE_FOLDER="$P/.c2" Y add @isaacs/string-locale-compare@1.1.0 --no-progress > "$W/dev-$m.add.log" 2>&1); rc=$?
200+
grep -E '^ resolved' "$P/yarn.lock" | sed 's/^/ LOCK1 /' | cut -c1-140
201+
n=$(grep -c "127.0.0.1\|file:" "$P/yarn.lock")
202+
result "case=dev-$m-add rc=$rc wired-lines=$n err=$(grep -m1 -i '^error' "$W/dev-$m.add.log" | cut -c1-90 | tr ' ' _) installed=$(markers "$P")"
203+
check "$P" dev-$m-after-add
204+
(cd "$P" && SOCKET_PATCH_SERVER_URL=$API "$SP" vex --product pkg:npm/root@1.0.0 -O "$W/dev-$m.vex.json" > /dev/null 2>"$W/dev-$m.vex.err"); rc=$?
205+
result "case=dev-$m-vex rc=$rc subs=$($PY -c "import json,sys;d=json.load(open(sys.argv[1]));print(','.join(sorted(c['@id'] for s in d['statements'] for c in s['products'][0].get('subcomponents',[]))))" "$W/dev-$m.vex.json" 2>&1 | tail -1)"
206+
if [ $m = vendored ]; then (cd "$P" && "$SP" vendor --check --json > "$W/dev-$m.chk.json" 2>&1); result "case=dev-$m-vendor-check rc=$? $(head -c 300 "$W/dev-$m.chk.json" | tr -d '\n ' )"; fi
207+
# pure-lockfile reinstall from scratch must not change the lock
208+
rm -rf "$P/node_modules"; cp "$P/yarn.lock" "$W/dev-$m.pre"
209+
(cd "$P" && YARN_CACHE_FOLDER="$P/.c3" Y install --pure-lockfile --no-progress > /dev/null 2>&1); rc=$?
210+
(cd "$P" && YARN_CACHE_FOLDER="$P/.c4" Y install --no-progress > /dev/null 2>&1)
211+
cmp -s "$P/yarn.lock" "$W/dev-$m.pre" && same=stable || { same=CHANGED; diff "$W/dev-$m.pre" "$P/yarn.lock" | head -20; }
212+
result "case=dev-$m-reinstall rc=$rc lock=$same installed=$(markers "$P")"
213+
done
214+
kill $MOCKPID 2>/dev/null
215+
PROBE_EOF
216+
BIN="$PWD/target/debug/socket-patch"; [ -f "$BIN.exe" ] && BIN="$BIN.exe"
217+
cd "$RUNNER_TEMP" && bash probe.sh "$BIN" "$YARN_V" > probe.log 2>&1 || true
218+
grep RESULT probe.log || true
219+
echo '--- tail ---'; tail -60 probe.log

0 commit comments

Comments
 (0)